Element <output>

Defines the Output. It has a start tag <output> and an end tag </output>.

It can be used in <out><out> replace default port like P0,P1,..etc.

And output id=1 -> O1, refer to Example

※ GRISM AH32 is not supported

Attribute

Attribute	Description	Type	Default (* must have)	Support
id	Specifies a unique id for an element	Interger	*
type	output type	String	mix
name	Specifies a name for an element	String
mtu	Maximum Transmission Unit	Interger	0(unlimited)
stl	Second To Live	Interger	0(unlimited)
minbps	Minimum bandwidth reserved	Interger	0(unlimited)	v3.7
maxbps	Maximum bandwidth reserved	Interger	0(unlimited)	v3.7
arp_dstip_mac	arp request for dstip mac	yes/no	no
arp_srcip	arp request for source ip	IPv4	0	v5.5

Example

<run>
  <output id="1">
    <port>P0</port>
    <stripping>vlan</stripping>
  </output>
  <chain>
    <in>P1</in>
    <out>O1</out>
  </chain>
</run>

Elements in Output

<port>

Defines output port(must have). It has a start tag <port> and an end tag </port>.

<output id="1">
  <port>P0</port>
</output>

<gateway>

Defines gateway It has a start tag <gateway> and an end tag </gateway>. The ouptut will send arp request to gateway for mac address, than use this mac to replace destination mac address on packet.

<output id="1">
  <port>P0</port>
  <gateway>192.168.1.1</gateway>
</output>

<Q>

Defines vlan tagging. It has a start tag <Q> and an end tag </Q>.

<output id="1">
  <port>P0</port>
  <Q>10</Q>
</output>

<QinQ>

Defines vlan layer 2 tagging. It has a start tag <QinQ> and an end tag </QinQ>.

<output id="1">
  <port>P0</port>
  <QinQ>20</QinQ>
</output>

<stripping>

Defines stripping. It has a start tag <stripping> and an end tag </stripping>.

support type

• payload

• vlan

• mpls

• gre

• vxlan

• gre-erspan

• gtp

• grism

• mpls-in-udp

• mpls-in-gre

<output id="1">
  <port>P0</port>
  <stripping>vlan</stripping>
</output>

<modify_srcip>

Defines modify source ip address It has a start tag <modify_srcip> and an end tag </modify_srcip>.

Attribute	Description	Type	Default (* must have)
nat	NAT support	yes/no	no

<output id="1">
  <port>P0</port>
  <modify_srcip>10.1.1.0</modify_srcip>
</output>

<modify_dstip>

Defines modify destination ip address It has a start tag <modify_dstip> and an end tag </modify_dstip>.

<output id="1">
  <port>P0</port>
  <modify_dstip>10.1.1.0</modify_dstip>
</output>

<modify_srcport>

Defines modify TCP/UDP/SCTP source port

<output id="1">
  <port>P0</port>
  <modify_srcport>500<modify_srcport/>
</output>

<modify_dstport>

Defines modify TCP/UDP/SCTP destination port

<output id="1">
  <port>P0</port>
  <modify_dstport>500<modify_dstport/>
</output>

<modify_srcmac>

Defines modify source mac address It has a start tag <modify_srcmac> and an end tag </modify_srcmac>.

<output id="1">
  <port>P0</port>
  <modify_srcmac>d8:fe:e3:a4:d3:78</modify_srcmac>
</output>

<modify_src_default_mac/>

Defines modify source mac address use port default mac address (ver. 3.8)

<output id="1">
  <port>P0</port>
  <modify_src_default_mac/>
</output>

<modify_dstmac>

Defines modify destination mac address It has a start tag <modify_dstmac> and an end tag </modify_dstmac>.

<output id="1">
  <port>P0</port>
  <modify_dstmac>d8:fe:e3:a4:d3:78</modify_dstmac>
</output>

<modify_swapmac>

Defines swap source mac address and destination mac address (v4.9)

<output id="1">
  <port>P0</port>
  <modify_swapmac/>
</output>

<modify_tcp_syn_mss>

Modify TCP syn or syn+ack option mss field (v5.1)

<output id="1">
  <port>P0</port>
  <modify_tcp_syn_mss>1300</modify_tcp_syn_mss>
</output>

<modify_dstip2nat>

Modify destination ip account to NAT table

<output id="1">
    <port>P0</port>
    <modify_dstip2nat/>
</output>

<tagging>

Defines tagging. It has a start tag <tagging> and an end tag </tagging>.

support type

• timestamp

• gtp

• gtp2

• l2gre (ver 4.8)

• vxlan (ver 5.1)

• grism

<output id="1">
  <port>P0</port>
  <tagging>l2gre</taging>
</output>

<maxlen>

Defines packet max length. It has a start tag <maxlen> and an end tag </maxlen>.

<output id="1">
  <port>P0</port>
  <maxlen>64</maxlen>
</output>

Save to Pcap file

<dir>

Defines output dir in Hard disk. Save packet to pcap files. It has a start tag <dir> and an end tag </dir>.

Attribute	Description	Type	Default (* must have)
timeout	timeout to next pcap file	seconds	0 (No timeout)
max_split_size	max pcap size	integer(bytes)	104857600 (100M)
category	category for pcap files by month, day, hour or minute	string	none

<output id="1">
    <port>H1</port>
    <dir>test</dir>
</output>

NVGRE encapsulation

<nvgre_dip>

Defines output to gre tunnel dest ip. It has a start tag <nvgre_dip> and an end tag </nvgre_dip>.

<nvgre_sip>

Defines output to gre tunnel source ip. It has a start tag <nvgre_sip> and an end tag </nvgre_sip>.

<nvgre_dmac>

Defines output to gre tunnel dest mac. It has a start tag <nvgre_dmac> and an end tag </nvgre_dmac>.

<nvgre_type>

Defines output to gre tunnel type eth or ip, default is eth . It has a sart tag <nvgre_type> and an end tag </nvgre_type>.

Example if interface sip set already

<output id="1">
    <port>P7</port>
    <nvgre_dip>192.168.1.201</nvgre_dip>
</output>

Example

<output id="1">
    <port>P7</port>
    <nvgre_type>eth</nvgre_type>
    <nvgre_sip>192.168.1.10</nvgre_sip>
    <nvgre_dip>192.168.1.201</nvgre_dip>
    <nvgre_dmac>00:0c:bd:0b:fd:36</nvgre_dmac>
</output>

VXLAN encapsulation

<vxlan_sip>

Defines output to vxlan source ip. It has a start tag <vxlan_sip> and an end tag </vxlan_sip>

<vxlan_dip>

Defines output to vxlan destination ip. It has a start tag <vxlan_dip> and an end tag </vxlan_dip>

<vxlan_sport>

Defines output to vxlan source port. It has a start tag <vxlan_sport> and an end tag </vxlan_sport>

<vxlan_dport>

Defines output to vxlan destination port. It has a start tag <vxlan_dport> and an end tag </vxlan_dport>

<vxlan_vni>

Defines output to vxlan vni. It has a start tag <vxlan_vni> and an end tag </vxlan_vni>

<arp_reply_target_mac>

Defines output reply arp target mac address. It has a start tag <arp_reply_target_mac> and an end tag </arp_reply_target_mac>.

<output id="1">
    <port>P0</port>
    <arp_reply_target_mac>00:0f:bb:ef:8a:25</arp_reply_target_mac>
</output>

Example for for inline (P6 <-> P7) reply target mac 02:00:00:00:00:00 when arp request ip 192.168.1.10

<run>
    <filter id="1" sessionBase="no">
    <or>
         <find name="arp.request.target.ip" relation="" content="192.168.1.10" />
    </or>
    </filter>
    <output id="1">
        <port>P6</port>
        <arp_reply_target_mac>02:00:00:00:00:00</arp_reply_target_mac>
    </output>
    <chain>
        <in>P6</in>
        <fid>F1</fid>
        <out>O1</out>
        <next type="notmatch">
            <out>P7</out>
        </next>
    </chain>
    <chain>
        <in>P7</in>
        <out>P6</out>
    </chain>
</run>

<arp_reply_default_mac/>

Defines output reply arp default port mac address. (v3.8)

<output id="1">
    <port>P6</port>
    <arp_reply_default_mac/>
</output>

<dns_response_ipv4>

Defines output response IPv4 address when dns query domain (not support EDNS yet). It has a start tag <dns_response_ipv4> and an end tag </dns_response_ipv4>.

dns_response_ipv4 Attribute

Attribute	Description	Type	Default (* must have)
noswapmac	do'nt swap mac address	yes or no	no

<output id="1">
  <port>P0</port>
  <dns_response_ipv4 noswapmac="yes">192.168.1.150</dns_response_ipv4>
</output>

Example for inline (P6 <-> P7) response ip 192.168.1.201 when dns query google.com

<run>
    <filter id="1" sessionBase="no">
    <or>
        <find n="dns.qry.name" r="==" c="google.com" />
        <find n="dns.qry.name" r="==" c="www.google.com" />
        <find n="dns.qry.name" r="==" c="ssl.gstatic.com" />
        <find n="dns.qry.name" r="==" c="www.gstatic.com" />
        <find n="dns.qry.name" r="==" c="apis.google.com" />
    </or>
    </filter>
    <!-- dns query type IPv4 and not EDNS -->
    <filter id="2" sessionBase="no">
    <and>
        <find n="dns.flags.response" r="==" c="0"/>
        <find n="dns.qry.type" r="==" c="1" />
        <find n="dns.count.add_rr" r="==" c="0" />
    </and>
    </filter>
    <output id="1">
        <port>P6</port>
        <dns_response_ipv4>192.168.1.201</dns_response_ipv4>
    </output>
    <chain>
        <in>P6</in>
        <fid type="and">F1,F2</fid>
        <out>O1</out>
        <next type="notmatch">
            <out>P7</out>
        </next>
    </chain>
    <chain>
        <in>P7</in>
        <out>P6</out>
    </chain>
</run>

<dns_response_ipv6>

Defines output response IPv6 address when dns query domain (not support EDNS yet). It has a start tag <dns_response_ipv6> and an end tag </dns_response_ipv6>.

dns_response_ipv6 Attribute

Attribute	Description	Type	Default (* must have)
noswapmac	do'nt swap mac address	yes or no	no

<output id="1">
  <port>P0</port>
  <dns_response_ipv6>::ffff:7a74:e554</dns_response_ipv6>
</output>

<icmp_reply/>

Defines output reply ICMP (v5.5)

<run>
    <filter id="1" sessionBase="no">
        <and>
            <find name="ip.dst" relation="==" content="192.168.1.10"/>
            <find name="icmp.type" relation="==" content="8"/>
        </and>
    </filter>
    <output id="1">
        <port>P0</port>
        <icmp_reply/>
    </output>
    <chain>
        <in>P0</in>
        <fid>F1</fid>
        <out>O1</out>
    </chain>
</run>

<icmp_reply_fragment_need/>

Defines output reply ICMP fragmentation needed packet (v3.10)

Attribute	Description	Type	Default (* must have)
mtu	MTU of next hop	UINT16	*

<run>
    <filter id="4" alt="ip df and packet len over 1500" sessionBase="no">
        <and>
            <find name="ip.flags.df" relation="==" content="1"/>
            <find name="packet.len" relation="&gt;=" content="1500"/>
        </and>
    </filter>
    <output id="6">
        <port>P6</port>
        <icmp_reply_fragment_need mtu="1440"/>
        <modify_srcip>172.16.10.10</modify_srcip>
    </output>
    <chain>
        <in>P6</in> 
        <fid>F4</fid>
        <out>O6</out>
        <next type="notmatch">
            <out>P7</out>
        </next>
    </chain>
    <chain>
        <in>P7</in>
        <out>P6</out>
    </chain>
</run>

type : httprequesthijack

Defines output http request hijack (and redirect to safeweb).

redirect2safeweb Attribute

Attribute	Description	Type	Default (* must have)
noswapmac	do'nt swap mac address	yes or no	no
redirectPort	redirect to Port	port (ex.P7)

Example for inline (P6 <-> P7) redirect http request url unsafe.com/ to safeweb

<run>
  <filter id="1" sessionBase="no">
    <or>
      <find name="http.request.url" relation="==" content="unsafe.com/" />
    </or>
  </filter>
  <output id="1" type="httprequesthijack">
    <port>P7</port>
    <redirect2safeweb>https://dnscare.packetx.biz/</redirect2safeweb>
  </output>
  <chain>
    <in>P6</in>
    <fid>F1</fid>
    <out>O1</out>
    <next type="notmatch">
      <out>P7</out>
    </next>
  </chain>
  <chain>
    <in>P7</in>
    <out>P6</out>
  </chain>
</run>

type : tcpreset

Defines output TCP reset hijack.

Example for inline (P6 <-> P7) reset ssl server name TCP connection

<run>
  <filter id="1" sessionBase="no">
    <or>
      <find name="ssl.server_name" relation="==" content="unsafe.com" />
    </or>
  </filter>
  <output id="1" type="tcpreset">
    <port>P7</port>
  </output>
  <chain>
    <in>P6</in>
    <fid>F1</fid>
    <out>O1</out>
    <next type="notmatch">
      <out>P7</out>
    </next>
  </chain>
  <chain>
    <in>P7</in>
    <out>P6</out>
  </chain>
</run>

type : udpencap

Defines output pcap header+packet throught UDP encapsulation.

Example

<run>
  <output id="1" type="udpencap">
    <port>P7</port>
    <dip>192.168.1.201</dip>
    <sport>3060</sport>
    <dport>3060</dport>
  </output>
  <chain>
    <in>P6</in>
    <out>O1</out>
  </chain>
</run>